Users & roles
Access in Pradra Studio is controlled by roles: a member's role determines what they can see and do in an organization or workspace — from read-only viewing through to full administration. The platform enforces roles on every action, in the UI and the API alike.
Who does what
Different people lean on different parts of the lifecycle:
| Role in the team | Typically cares about |
|---|---|
| Business / product owner | Defining the solution and what "good" means — the acceptance criteria. |
| Data scientist | Datasets, features, training, and evaluation. |
| ML engineer | Deployments, endpoints, and monitoring. |
| Operator | The day-to-day: dashboards, alerts, approvals, budgets. |
| Administrator | Organizations, workspaces, members, secrets, and access itself. |
You don't have to fit neatly into one box — the platform simply makes sure each task has a clear home and a clear permission behind it.
How permissions work
- Permissions are grouped into roles; administrators assign a role when adding a member to a workspace or organization.
- Sensitive surfaces carry their own permissions — managing secrets, granting fine-tuning consent, registering agent tools, editing the plan catalog — so "administrator" isn't one giant switch.
- An agent run never exceeds the permissions of whoever started it, and approving an agent's consequential action re-checks the approver's permission at that moment.
- Platform-level administration (e.g. the subscription plan catalog) is reserved for platform administrators and is not available to organization admins — the catalog is shared across tenants.
Signing in
You reach the platform with an email and password. Sessions are short-lived and refreshed automatically; signing out invalidates them. For programmatic access — your application calling a deployed capability — use an API token instead of a password.
Managing members in the Studio
- Go to Administration → Users to see and manage members (administrator role required).
- Add a member to a workspace and pick their role; change or revoke it any time — enforcement is immediate.
- A deactivated account is offline but not erased: its history and audit records stay intact.
Every assignment and revocation lands in the audit trail.
Next
- Machine access: API tokens.
- The full trust story: Governance & audit.